Give your Supabase app its own MCP server

Every tool call runs as the signed-in user, so the RLS you already wrote decides what each agent reaches.

Sources